What 2028 Really Means for CMMC

Picture this: your compliance director forwards a LinkedIn post claiming C3PAO assessments are “pushed to 2028.” Your CFO reads it as permission to shelve the readiness budget for two more years. Nobody in the room checked where that date actually came from.

Here's the problem: that's not what happened.

What 2028 actually is

Class Deviation 2026-O0025, Revision 3 — issued September 3, 2026 by the Office of the Assistant Secretary of War for Acquisition and Sustainment — didn't invent a new resumption date for CMMC Phase 2. Look at the clause itself, DFARS 252.204-7021, and the split is explicit: until November 9, 2028, the CMMC level requirement applies only “if the program office or requiring activity determines that the contractor is required to have a specific CMMC level.” That's discretionary — a case-by-case call. On or after November 10, 2028, it applies automatically to any contract where the contractor's systems will “process, store, or transmit FCI or CUI.” No determination needed at that point; it's baked in.

That second date — November 10, 2028 — is the number circulating on LinkedIn right now. But it's the automatic-trigger date, not the day C3PAO assessments start again. Phase 2, the phase that actually puts a third-party assessment between your self-attestation and a contract award, has no announced resumption date in this document or any other. Treating 2028 as the answer to “when do I need a C3PAO” answers a different question than the one being asked.

Why the gap between the two dates matters more than either date alone

Here's the detail worth sitting with: the same clause that sets the 2028 backstop never removed a program office's ability to require C3PAO before then. The regulatory mechanism for “specific CMMC level” designation — which includes Level 2 (C3PAO) — is still sitting in 252.204-7021 exactly as written. What's currently keeping most offices from using it is a separate, much more fragile instrument: the July 13 CIO memo directing contracting officers to only include Self-assessment levels while Phase 2 is paused. A policy memo can be reversed with a signature, on any morning, without touching the regulation at all.

This isn't theoretical. The Defense Logistics Agency's own CMMC FAQ page — a living document DLA updates directly — states plainly: “DLA may start implementing CMMC Level 2 (C3PAO) in contracts on about November 10, 2027.” It goes further, distinguishing manual solicitations (no C3PAO requirement before November 10, 2027) from automated ones (C3PAO requirements may begin November 10, 2028). That's a full year ahead of the date most of the Defense Industrial Base (DIB) is treating as the earliest possible resumption — stated by one agency, in writing, on its own site.

DLA isn't unique in having this kind of internal planning target; it's simply the one that's published it. The pattern holds regardless of which office moves first: nothing in the regulation stops a program office from designating C3PAO the moment its own internal timeline says to, independent of when — or whether — a department-wide resumption gets announced. The point isn't that November 2027 is now the DIB's new deadline. It's that a deadline earlier than 2028 is already sitting in writing at one agency, which means the assumption that nothing happens before 2028 was wrong from the start.

What stays true regardless of which date is right

We're contractors going through this ourselves, not consultants watching from the sidelines — and the position we've settled on is this: none of the open questions here change what NIST SP 800-171 requires today. DFARS 252.204-7012 doesn't pause. Your SPRS score doesn't pause. And the readiness work behind a C3PAO assessment — documented evidence, a defensible SSP, closed or well-managed POA&M items — isn't work that gets wasted if the timeline shifts in either direction. It's the same work whether your assessment is six months out or two years out.

The organizations that will be scrambling when DLA's stated 2027 timeline arrives — or when any other agency moves on its own internal clock — are the ones that read “2028” as a green light to stand down. The ones with a head start will be the ones who treated the uncertain department-wide date as the reason to keep moving, not the reason to wait.

Where to start

If you don't know where your own contract portfolio actually stands — which program offices you're under, what they've signaled, how close your evidence is to assessment-ready — that's the gap worth closing first, regardless of what date ends up being right.

Schedule your free Gap Assessment →

Sources

1. DARS Tracking Number 2026-O0025, Revision 3 — Class Deviation, DFARS Part 240 — Office of the Assistant Secretary of War (Acquisition and Sustainment), September 3, 2026. DFARS 252.204-7021(a)(1)–(2).
2. DLA CMMC Frequently Asked Questions and Answers — Defense Logistics Agency. Living document, most recently published June 3, 2026 — verify currency before publishing.
3. Pentagon suspends CMMC phase two requirements, launches review of program — Federal News Network, July 2026. Source for the pre-pause program-office C3PAO precedent claim — verify before publishing.